Release 4.4.3

Change-Id: Id71b06d6f99413012a66288bad7121fb03ff050f
Reviewed-on: https://gerrit.stanford.edu/910
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add a NEWS entry for the clang --analyze fixes

Change-Id: Iabd1de7f74f52243635d014ba02f06087c51ea29
Reviewed-on: https://gerrit.stanford.edu/909
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix syntax error in mod_webauth logging change

Reviewed-on: https://gerrit.stanford.edu/884
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit cbe4864fcc231b1750be0544fd7b33c5ed1b46b2)

Change-Id: I1835998041a1c9cbd4229d1a3e9f6af2ca7bc75f
Reviewed-on: https://gerrit.stanford.edu/908
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Don't log the raw app token when it cannot be decoded

Stop logging the raw binary app token in mod_webauth when it cannot be
decoded.  This was old debugging code left over from fixing a problem
in a much earlier version of WebAuth.

Reviewed-on: https://gerrit.stanford.edu/883
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 4cf471d86cbf05c10a70162971b61820b22a1d84)

Change-Id: I3d50916a5b5c46ca7ec226b688f2f5ff57cd8d02
Reviewed-on: https://gerrit.stanford.edu/907
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Better mod_webauth logging when the app cookie has expired

Log a more informative message in mod_webauth when the user's app
cookie has expired instead of a generic parse error and downgrade it
to the info level from error.

Reviewed-on: https://gerrit.stanford.edu/882
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit d6ca404959087123e22e82c21854d63b141bc3d9)

Change-Id: I3657900ff3faff4ecda22f53dbffe34af9ec4265
Reviewed-on: https://gerrit.stanford.edu/906
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Ignore empty app cookies in mod_webauth

Ignore empty app cookies rather than logging an error saying they
cannot be parsed.  These are created internally by mod_webauth to
remove expired cookies and may be seen by subqueries.

Reviewed-on: https://gerrit.stanford.edu/881
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 32f1831f650f1241c1b9a6952d24db01120d9b4a)

Change-Id: Ib9fc546175a97d48ce709ef9078120779e305e8b
Reviewed-on: https://gerrit.stanford.edu/905
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Avoid calling malloc(0) in the xmalloc test

xmalloc(0) is valid and something that we'll test, but malloc(0)
isn't.  When probing for malloc sizes, malloc at least one byte.
Caught by clang --analyze.

Reviewed-on: https://gerrit.stanford.edu/871
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit bc8b776faa97f0c37603a63f88cdea17727521a0)

Change-Id: I67966885e5e4587ba829eb947c64f44938e9df7e
Reviewed-on: https://gerrit.stanford.edu/904
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Run the lib/apr-buffer test during make check

This was apparently missed when the test suite was originally
written.

Reviewed-on: https://gerrit.stanford.edu/869
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 892f5839b304a485ed78c9a29cd4612924433a1f)

Change-Id: I3ad7cb09b80424af5c652eeeaa10be28901eb8d5
Reviewed-on: https://gerrit.stanford.edu/903
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Avoid possible NULL dereference when checking LoA

In the WebKDC login code, if the user information service call
failed but we have a minimum LoA from the request, we might
dereference a NULL pointer when determining the correct error
message if the existing authentication has too small of an LoA.
Caught by clang --analyze.

Reviewed-on: https://gerrit.stanford.edu/866
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 396426af6f108416cef9bcb403cf0b191d490b45)

Change-Id: I0d3aaaaf6e0ae619831c8c1f39284b0563db3919
Reviewed-on: https://gerrit.stanford.edu/902
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Avoid freeing stack garbage on mod_webauthldap cred failure

If we failed to get a credential because we couldn't parse the
principal in mod_webauthldap, we might attempt to free stack
garbage.

Reviewed-on: https://gerrit.stanford.edu/865
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit ffe7a8a5c0a6f2272469b917cd5bfde8db8b53a9)

Change-Id: I2d40df57fc81cb8d1ef82ca143759dd079135375
Reviewed-on: https://gerrit.stanford.edu/901
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Properly check the result when decoding Kerberos credentials

We were ignoring the result of the decoding and continuing on with
an all-zero credential struct.  We would reject that later for other
reasons, but return the error right away.

Reviewed-on: https://gerrit.stanford.edu/864
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 76e87f9c9a5fa66d99985c1ea6248503f1cba016)

Change-Id: I894cf19f0622976f44686fa59ff998e993efab0e
Reviewed-on: https://gerrit.stanford.edu/900
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Allow webauth_factors_string to take a NULL argument

If a NULL struct is passed in, return NULL.  This was used at one
place in lib/webkdc-login.c even though gcc was told that it was
impossible.  Caught by clang --analyze.

Reviewed-on: https://gerrit.stanford.edu/862
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 15371f19e888f81d16b844435d1a73f62f140105)

Change-Id: I69bdd627d00ea2bd9d0f12ebfcbb67aa2d93a5c9
Reviewed-on: https://gerrit.stanford.edu/899
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Catch apr_filepath_merge failure in mod_webauth

Failure was ignored rather than aborting the function and logging
an error.  Caught by clang --analyze.

Reviewed-on: https://gerrit.stanford.edu/860
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit f765c9e98873bdbd3c814f5c9e29419a081700e8)

Change-Id: Ibd6010d59363a8d7edd7ae87f952a9bce847e3d0
Reviewed-on: https://gerrit.stanford.edu/898
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add support for WEBAUTH_PERL_FLAGS while building

If this variable is set as a make variable, its contents will be
passed to the perl Build.PL invocation.  This is primarily to
support Debian package builds, which need a way to pass additional
flags to the Perl module build.

Reviewed-on: https://gerrit.stanford.edu/832
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 9c79b629ab98dbb61e5682031213f35d4f42a7a1)

Change-Id: I41099491bf0075211ef175653928a48bc64241f2
Reviewed-on: https://gerrit.stanford.edu/897
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix obscure time bug in the Perl token-decode test

Similar to an earlier bug in token-encode, when checking raw encoding, we
build the encoding we expect using pack, but the old version of the test
doesn't allow for the possibility that the encoded time will happen to
contain the byte for an ASCII semicolon.  Add a function to wrap pack and
double the semicolon in that case.

(This actually randomly happened.)

Reviewed-on: https://gerrit.stanford.edu/821
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 2e57152fb01fd3e484c3b25ff411d3dda0748e0c)

Change-Id: I6b3c993aaa1f8239d678b9edb1952ceb611e4061
Reviewed-on: https://gerrit.stanford.edu/896
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

WebAuthTrustAuthzIdentity should not enable WebAuthDoLogout

Fix a coding error in the WebAuthTrustAuthzIdentity directive parsing
that also enabled WebAuthDoLogout for the same scope.

Reviewed-on: https://gerrit.stanford.edu/818
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit d02cf3f4507fe0dbdb188b906bc2bb81a75c6190)

Change-Id: I9c27c8ea3685d98c7088a984e1f39b72cf950d22
Reviewed-on: https://gerrit.stanford.edu/895
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix syntax error in default WebLogin error template

Fix syntax error in the replay condition in the default WebLogin error
template.

Reviewed-on: https://gerrit.stanford.edu/802
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 60cdd81e0c9e3eae42ec257eb019b54e038fc4a6)

Change-Id: I133fab72c35c50ae3e04c915ed44e10a4f948abe
Reviewed-on: https://gerrit.stanford.edu/894
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix handling of equal authorization and authentication ids

If the user asserts an authorization identity equal to their
authentication identity, discard the authorization identity in the
WebKDC login process and continue as if they did not choose an
authorization identity.  This fixes a previously fatal error when the
user selects their default identity in WebLogin (if, for example, they
are trying to undo a previous choice of authorization identity).
Thanks to Benjamin Coddington for the report.

Reviewed-on: https://gerrit.stanford.edu/801
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 3f08b0e50423a14585c87295b6171f4eab1b9abd)

Change-Id: I7d347da7ad51af60ee6a9e4d01da36a3019b477d
Reviewed-on: https://gerrit.stanford.edu/893
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add the URL to the user information service specification

This was missed in the install-multifactor setup documentation when
we added this for user restriction support.  Document that the url
parameter comes before the factors parameter, and that we will send
the empty string if we have factors and no URL.

Reviewed-on: https://gerrit.stanford.edu/764
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 5aa9301010e3b86f41d6ff64983dd8babaea11b5)

Change-Id: I50c01cb05aa2a7278a33da68d977bf9a1c2a8dce
Reviewed-on: https://gerrit.stanford.edu/892
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix indentation error in the install-stanford guide

Also reword two of the headings to improve the performance of
faq2html.

Reviewed-on: https://gerrit.stanford.edu/762
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
(cherry picked from commit 0a95f3568a429b33b495b48fd73a13d36b1b692a)

Change-Id: I9b68eca249433913857412e8e9c86aef223159b4
Reviewed-on: https://gerrit.stanford.edu/891
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove limit on multivalued attributes in mod_webauthldap

Remove an arbitrary limit in mod_webauthldap on the number of values
from a multivalued LDAP attribute that are put in the environment.
Previous versions would only add the first 127 values, but there are
some cases where one may want to see more values than that.  This
opens the possibility of overflowing the allowed size of the
environment, but the maximum environment size is quite large on most
modern operating systems.

Change-Id: I2280929fe55d44f7c374c1362bcb2e91f37f8cf0
Reviewed-on: https://gerrit.stanford.edu/760
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update Perl coding style in utility scripts

Always cuddle else.  Use a standard preamble for most scripts.
Adjust for requiring regex metacharacters to be escaped with
character classes again.  Redo how checked print and say are
handled and be more consistent about always passing the file
handle.  Add parens around built-in arguments (ick) in most cases.
Clean up a few other minor things I noticed while going through
the scripts.

Change-Id: I9f7cd0ee4aaf1cdb7d73a70dfd3f4f4a8025c9b7
Reviewed-on: https://gerrit.stanford.edu/753
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update Perl coding style configuration

Following an IDG meeting about Perl coding style, update the style
configuration for the result of that meeting.  Reintroduce the test
for escaped metacharacters (I'll override with no critic where needed),
allow parens around arguments to built-ins, and don't force blank
lines before comments since we're now always cuddling else.

Change-Id: I0469671b3e4a55ceb3e5f35afdeb348b6505cfc7
Reviewed-on: https://gerrit.stanford.edu/752
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix obscure bug in the Perl token-encode test

When checking raw encoding, we build the encoding we expect using
pack, but the old version of the test doesn't allow for the
possibility that the encoded time will happen to contain the byte
for an ASCII semicolon.  Add a function to wrap pack and double
the semicolon in that case.

(This actually randomly happened in one Debian package build.)

Change-Id: I9ad5cef3d3ecabe4e0a5ce3f19d6e48e17c2736c
Reviewed-on: https://gerrit.stanford.edu/751
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove invalid markup from protocol.xml

The xml2rfc DTD doesn't allow <code>.

Change-Id: I88264f7ed829127779b55c2bbbb2eac0f6901824
Reviewed-on: https://gerrit.stanford.edu/750
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Release 4.4.2

Change-Id: I99856f6f92cb1474ee83e355d06406c681982287
Reviewed-on: https://gerrit.stanford.edu/749
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add protocol updates for persistent factors

Update the protocol specification to add factor tokens to the
<requestTokenRequest> and <requestTokenResponse> APIs and to define
a new webkdc-factor token type.  Add the cookie naming used to store
those tokens in the browser.  Update the user information service
API to pass already-established factors to the webkdc-userinfo
request and to allow the webkdc-validate response to set persistent
factors.

Change-Id: Iee0c776aa8774aa1df0499a77db88bb1729abad9
Reviewed-on: https://gerrit.stanford.edu/748
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Put back a to-do item that's not actually done

We still need to fix the use of CGI::Application parameters.

Change-Id: I7afa8dcd01eb91c1f6cce398ec462b90e7e321ef
Reviewed-on: https://gerrit.stanford.edu/747
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix Perl builds when builddir != srcdir

Fix out-of-tree builds with --enable-webkdc.  Some of the logic to
ensure the Perl modules could build when the build directory was not
the source directory had not been tested for a while.

Not all the right directories were being created to copy over the
Perl source files, and the Perl build didn't have all the right -I
flags to pick up the portable/* header files.

Also simplify make distclean when builddir != srcdir to not bother
trying to remove the perl subdirectories.  make distclean in this
situation rarely tries hard to remove directories.

Change-Id: If8fd5d6d17fe51bf3e7c3e23bdca773bf5b75297
Reviewed-on: https://gerrit.stanford.edu/746
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add NEWS entry for uninitalized variable fix in the WebKDC

Change-Id: Ib9958fe7c7923a65871ae5e583cd0cd898d698e6
Reviewed-on: https://gerrit.stanford.edu/745
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Ignore a subdirectory builddir in Perl tests

Give the Perl tests even more intelligence about directory manipulation
so that they can detect the case where the build directory is a
subdirectory of the source directory and where the path to the source
directory is given as .. instead of a full path.  In that case, don't
try to check syntax or coding style of files in the build directory.

Change-Id: I5055622cddb761efcc0ffa5f24e63ca8ae21c687
Reviewed-on: https://gerrit.stanford.edu/744
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove gcov data files on make clean

There doesn't seem to be an easy way to tell Automake to do this,
so do it manually in a clean-local rule.

Change-Id: I1c28de3554ac48312cae81631eead66d3d3db001
Reviewed-on: https://gerrit.stanford.edu/743
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix uninitialized variable when checking for interactive logins

Change-Id: I513cf454ca3728aa874560f8a10e9d80e7d3f0db
Reviewed-on: https://gerrit.stanford.edu/742
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add AM_PROG_AR to configure.ac for Hurd

Attempting to run autoreconf on Hurd produces the error:

warning: 'modules/webauth/mod_webauth.la': linking libtool libraries
using a non-POSIX archiver requires 'AM_PROG_AR' in 'configure.ac'

Do what the message says and see if it helps.

Change-Id: Ic989f94b45df493773dd369197d69de5d9740b36
Reviewed-on: https://gerrit.stanford.edu/741
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add d factor code to docs and lib/internal.h

This is the factor code for a recognized device or browser,
according to local site policy.

Change-Id: I692d49883004826401b415db9210784993625a6f
Reviewed-on: https://gerrit.stanford.edu/740
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add tools/clean-apache-manual to EXTRA_DIST

Change-Id: Ie85cdd7484e8bf55ede13f63abae6ecf42b15e53
Reviewed-on: https://gerrit.stanford.edu/739
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Adjust PERL_FILES for the switch to Module::Build

Change-Id: I7c46cdf7e093cc49acba7001500fe90d6de02800
Reviewed-on: https://gerrit.stanford.edu/738
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Release 4.4.1

Change-Id: I2e20f43ac622e54ac2e9e7a72be99951afe88793
Reviewed-on: https://gerrit.stanford.edu/737
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update HACKING for documentation build and release process

Point to the current Apache documentation branches and add a mention
of the clean-apache-manual script.  Remove the instructions to create
*.md5 files.

Change-Id: I644eca90e4c678c4d44b37f37f54ff0d694276d8
Reviewed-on: https://gerrit.stanford.edu/736
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Hide "Copyright" in clean-apache-manual from build-license

Having a copyright line in the regex data for clean-apache-manual
was confusing the script I use to generate the LICENSE file.  Work
around that with a trivial character class.

Change-Id: Idaddf336aa1190544f45dbac2124e190c2a821dd
Reviewed-on: https://gerrit.stanford.edu/735
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Expand WebAuthSSLReturn documentation to mention RequireSSL

Be clearer about the link, and set WebAuthRequireSSL to off in the
WebAuthSSLReturn directive example.

Change-Id: I07c59a34898481e3c0d120531ce33d7a99b4e721
Reviewed-on: https://gerrit.stanford.edu/734
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Document theming WebLogin via environment variables

Add documentation to install-webkdc explaining how to point WebLogin
at multiple configurations while using the same code by setting an
environment variable inside Apache.  (Doesn't work with FastCGI,
sadly.)

Document the environment variable for the configuration file path in
weblogin-config.

Change-Id: Ia862e1f93e57b1cfaa9c87a6235845784ceffe0d
Reviewed-on: https://gerrit.stanford.edu/727
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Switch Perl build process to Module::Build

WebLogin and the WebAuth Perl bindings are now built with
Module::Build instead of ExtUtils::MakeMaker.  This should be
transparent to anyone not working with the source code, but
Module::Build and ExtUtils::CBuilder are now required to build the
WebLogin code.  They are included in Perl 5.10 or later and can be
installed separately for older versions of Perl.

Change-Id: I79f137bcc7e465e367c4c0fb423378fcd7ffc24a
Reviewed-on: https://gerrit.stanford.edu/726
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Strip Apache-specific manual bits, add section links

Process all of the Apache module manuals with clean-apache-manual
to remove Apache-specific bits and an incorrect copyright and
license statement.  Add sidebar links to the non-directive sections.

Change-Id: I4e6d58edfd6f03e16f6ad9996a53c64d96811876
Reviewed-on: https://gerrit.stanford.edu/722
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add a new script to clean up generated module manuals

The XML format for documenting Apache modules, and the corresponding
build system to generate formatted HTML, is quite useful even outside
of Apache for documenting external modules.  However, the output of
the Apache documentation build system includes some Apache-specific
content, such as a comments section that only works on the Apache site
and a license (Apache 2.0) that may not be appropriate.

This script is used to post-process the formatted documentation for
the WebAuth Apache modules to remove those elements.  It should work
(but has not been tested with) Apache module documentation for other
third-party modules.

Change-Id: Id5df610e403b80c625965337742fd78006e2ace0
Reviewed-on: https://gerrit.stanford.edu/721
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Import new perlcritic definition from rra-c-util

Disable a few more things that aren't reasonable restrictions.

Change-Id: I65d9ec5f0a5a3b939a078e2e79f97dc6d917e87a
Reviewed-on: https://gerrit.stanford.edu/720
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove completed work from TODO

Change-Id: I8ecb79be411f0ac3193f902cb7b36fc1af41ca78
Reviewed-on: https://gerrit.stanford.edu/719
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Use a persistant CGI::Application object in WebLogin

When run under FastCGI, the WebLogin scripts now use a persistent
CGI::Application object instead of recreating it for each query.  This
avoids reinitializing the Template Toolkit and reopening memcached
connections for each query.

Change-Id: I6bc15d9e8b7eaf2b760200e1cd1b1053c2830a04
Reviewed-on: https://gerrit.stanford.edu/718
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update perlcritic and perltidy configuration

Synchronized with rra-c-util 4.8 (unreleased) as of this date.

Change-Id: Ic089696ae53aa649c8545d633f04a0ff0efd6af7
Reviewed-on: https://gerrit.stanford.edu/717
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add support for a WebLogin authenticate callback

Add a new authenticate callback to the WebLogin configuration.  If
this function is present in webkdc.conf, it will be called for every
user visit to WebLogin and may return the user's authentication
information or an empty list to defer to normal handling.  This can be
used to extract authentication information from the full WebLogin
environment; for example, it could map information about a successful
client-side certificate authentication to an authentication identity.

Change-Id: Ife843e431c021a4b7ea83b00090e8778830f4e23
Reviewed-on: https://gerrit.stanford.edu/716
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Improve skip_all comments for various Perl tests

Change-Id: I835b6a5f452fefb2e404676dce248c7d28053266
Reviewed-on: https://gerrit.stanford.edu/690
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add some more comments on the limitations of tests/perl/strict-t

Change-Id: I16e4ab78c730babf381140cea57662a2e2e4385c
Reviewed-on: https://gerrit.stanford.edu/689
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Move Test::Strict in README to maintainer-only

Change-Id: Ia707a744a145cdcbdb12e3622faef3441a740797
Reviewed-on: https://gerrit.stanford.edu/688
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Skip maintainer-only tests before checking for SOURCE

May as well be friendly to people running them the wrong way
and tell them that this isn't the test they're looking for
up-front.

Change-Id: Ia8d2aec01eb920963228a83a0af30894caf87ded
Reviewed-on: https://gerrit.stanford.edu/687
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Make perl/strict test only run in maintainer mode

Random scripts in the source directory may require optional Perl
modules be installed or have other dependencies that can't be
satisfied by every user.  Also, otherwise we have to find a way
to add the path to the Perl modules we just built, and do something
else when built without the WebKDC.

Change-Id: Ia1908043af541fe83596c82ea4e06c70d5d6070d
Reviewed-on: https://gerrit.stanford.edu/686
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix alphabetization in libwebauth.map

Change-Id: Ib5e9b02695c01af6dddd48afcf96f4f7ba511456
Reviewed-on: https://gerrit.stanford.edu/685
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove duplicate mention of Test::Spelling in README

Change-Id: Ia28926252db6bfee53f85359928fe0c7fc6e859d
Reviewed-on: https://gerrit.stanford.edu/684
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update EXTRA_DIST for new and moved files

Change-Id: I8192857f110461ff51194609abef24d500ab4d63
Reviewed-on: https://gerrit.stanford.edu/683
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Release 4.4.0

Change-Id: I9f350b4b7c4d1ddd7e4102ea02da11bdfe3f73b3
Reviewed-on: https://gerrit.stanford.edu/682
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update documentation tests from rra-c-util

Add comments and a missing File::Spec inclusion.

Change-Id: I74be4a2040b8b427e515ec237a11573a7aa7e459
Reviewed-on: https://gerrit.stanford.edu/681
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update generic Perl tests to rra-c-util versions

Some minor comment and declaration improvements.  Preserve local
changes limiting what's checked.

Change-Id: Ia07b3ffc2b77444d4fef12e43114b11bdb5236a0
Reviewed-on: https://gerrit.stanford.edu/680
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update LICENSE for new files in the 4.4.0 release

Change-Id: I682a6a886980ae9bcac467166ebc990bf178d91f
Reviewed-on: https://gerrit.stanford.edu/679
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Document that Perl critic configuration comes from rra-c-util

Add a header to the perlcriticrc and perltidyrc configuration files
stating their origin, and add a license statement to perlcriticrc,
which is large enough to require it.

Change-Id: I43fb20df78429e454ed176fba076893ce985afa2
Reviewed-on: https://gerrit.stanford.edu/678
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add copyright and license to autogen

This file is now long enough to warrant it.

Change-Id: I28b46e5c2cfbf20c0b4f20d18a0a9e84dc3b4ce5
Reviewed-on: https://gerrit.stanford.edu/677
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add test suite for strndup replacement

Change-Id: Idefbd0b814d72a530bd94ca51a793f4a67f689e2
Reviewed-on: https://gerrit.stanford.edu/676
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update to rra-c-util 4.7

* Fix probing for Heimdal's libroken to work with older versions.
* Checked asprintf variants are now void functions and cannot fail.
* Include a replacement strndup for systems that don't have it.

Change-Id: Ida64920304345a206cc1d1474c1f6525ae728c83
Reviewed-on: https://gerrit.stanford.edu/675
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix badly out-of-date mailing list information in README

Change-Id: I5c611a1c7eab62b1611d30804c8d6ae8f8341914
Reviewed-on: https://gerrit.stanford.edu/674
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update dependency information in README

List the new test suite dependencies and reorganize and reformat
to hopefully make clearer.

Change-Id: I0833a7cdb011dee62ba85e75f73c94a409e71c8e
Reviewed-on: https://gerrit.stanford.edu/673
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add CGI::Application init fix to TODO, reorder one item

Change-Id: Id7120e175a657862a88c4594cdb7bc58dfb4caab
Reviewed-on: https://gerrit.stanford.edu/672
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Document authz identity interaction with proxy tokens and auth type

Document that authorization identities are ignored when using a
subject auth type of krb5, and that id and cred tokens obtained
from proxy tokens will not include the authorization identity.
Also document that delegated credentials will always be for the
authentication identity.

Change-Id: I3f00d69ac4a847fab846bb332e87e843a408f4aa
Reviewed-on: https://gerrit.stanford.edu/671
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Ignore authorization identity for krb5 subject auth type

Setting the subject auth type to krb5 indicates that mod_webauth
should independently verify the identity of the user.  Since the
authorization identity cannot be independently verified, it will
be ignored in this case.

Change-Id: Id770c68b9c643b97c6bbbf4177ad26a8d97cafa8
Reviewed-on: https://gerrit.stanford.edu/670
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Simplify Heimdal code for decoding flag bits

The logic that I originally copied from the Heimdal source was
excessively complex because it was manipulating a flag value that
was in network byte order rather than host byte order.  Our attribute
decoder guarantees that everything will be in host byte order before
we see it, so we don't have to manipulate the mask based on local
byte order.

Change-Id: I73a49c4e9ceecf88771925b9069b18e87d933e8c
Reviewed-on: https://gerrit.stanford.edu/669
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Probe for Kerberos headers using file existence in some cases

Probe for Kerberos headers using file existence checks instead of the
compiler if a Kerberos root or include path was given.  Otherwise, the
compiler may find the wrong header in the system default include path and
incorrectly assume krb5.h should be used instead of krb5/krb5.h.

Change-Id: Id798cd8ca8b33d61510168f6d40da6707d121ea5
Reviewed-on: https://gerrit.stanford.edu/668
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix encoding and decoding of ticket flags with Heimdal

Fix encoding of ticket flags with Heimdal Kerberos and tolerate the
old, incorrect encoding.  All previous versions of WebAuth, when built
with Heimdal, encoded the ticket flags on the wire with the flag bits
reversed (matching the in-memory Heimdal format).  Prior to this
version, flags would be lost when reading credentials encoded via MIT
Kerberos with Heimdal or vice versa.  As of this release, the portable
flag encoding used for ticket caches is used when writing credentials
with both MIT and Heimdal, and the flag order is detected when
decoding credentials and fixed if necessary.  If you use delegated
credentials and link with Heimdal Kerberos, upgrade mod_webauth prior
to upgrading the WebKDC to ensure the ticket flags are conveyed
correctly.

Change-Id: I058c573b210b0b1b26815e1c951ed222df7552a2
Reviewed-on: https://gerrit.stanford.edu/667
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix the Kerberos test suite to build with Heimdal

Various problems on Heimdal crept in.  Also add two more credentials
to test with: an Active Directory ticket encoded with Heimdal and a
ticket encoded with the old method of encoding the flags.  Fixes to
the flag encoding are coming in the next commit.

Change-Id: I27837739a4e7f475dac43ee7dfc314c08e3f85e5
Reviewed-on: https://gerrit.stanford.edu/666
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add tests for the minimum version of Perl

Change-Id: I282934152053922308713521f179dd6539515203
Reviewed-on: https://gerrit.stanford.edu/665
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Note Perl 5.8.0 requirement for some modules

Apparently use base qw(Exporter) requires Perl 5.8.0.  Mark the
two modules that use Exporter accordingly, and update the version
requirement in README.

Change-Id: I2d8e71032120ee65391dd01acb3d4836a14f551d
Reviewed-on: https://gerrit.stanford.edu/664
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove useless Exporter from WebAuth::Exception

This module doesn't export any symbols, so there's no reason to
load Exporter.  That also makes it work with Perl 5.6.0.

Change-Id: Ic962662889afb45bfb5605d2c75fe94eab769285
Reviewed-on: https://gerrit.stanford.edu/663
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Test encoding tickets that have addresses in them

Change-Id: I9931b3282370c9eec2c80cbe71de9c9acce8416f
Reviewed-on: https://gerrit.stanford.edu/662
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add const and static to krb5-cred-t.c data, add to TESTS

Change-Id: I931b6c49661ecc6ee0bbce0955d65312baa3bb25
Reviewed-on: https://gerrit.stanford.edu/661
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add stopwords to make-krb5-cred POD

Change-Id: I1e2b78e38f71e236847699e01d3370847581b6af
Reviewed-on: https://gerrit.stanford.edu/660
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Test imported credentials by getting a service ticket

Change-Id: I9289f57dd1d2444b28aa91cd492ba93a669dad01
Reviewed-on: https://gerrit.stanford.edu/659
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove stray debugging code in lib/krb5-mit.c

Change-Id: I0530c0d6e4de1fd8f4ae0c04d116e8351edc969a
Reviewed-on: https://gerrit.stanford.edu/658
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add tests for expected addresses in decoded credentials

Change-Id: Iaed5a20ce828e8fec15b6b07c463a402db10716f
Reviewed-on: https://gerrit.stanford.edu/657
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add README files for tests/data/{creds,tokens}

Explain how this test data was generated and what it is normally
used for.

Change-Id: I0547ac451bfa75bb70f61b6e32a48f23650a231f
Reviewed-on: https://gerrit.stanford.edu/656
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add test suite for decoding existing Kerberos credentials

Take apart some encoded Kerberos credentials included in the package
test data and ensure that the results match what we expect.  Checking
of addresses is not yet implemented.

Also add a Perl script, make-krb5-cred, which will generate Kerberos
credentials from a ticket cache.

Change-Id: Iaedb012dac42424e6a9a4c581a527358df033c1f
Reviewed-on: https://gerrit.stanford.edu/655
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix encoding of Kerberos credentials with addresses or authdata

Fix encoding of Kerberos credentials containing addresses or authdata
when built against MIT Kerberos.  WebAuth 4.3.0 and later would fail
to encode those credentials properly.  This bug only affects people
using credential delegation with either Active Directory or with
Kerberos configured to add addresses to tickets, which are relatively
rare configurations.

Change-Id: Ieaa31bf0c11ca0dbc40ee8bb181b36bea05824c5
Reviewed-on: https://gerrit.stanford.edu/654
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Perl: Interpret more empty string arguments as NULL

For init_via_cache and export_cred, interpret an empty string argument
as NULL for the first optional argument.

Change-Id: I315b328d95d31e5eaf5f98894e564637deb7adda
Reviewed-on: https://gerrit.stanford.edu/653
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix encoding of second ticket in Kerberos creds

The second ticket erroneously had the same encoding attribute as the
first ticket.  Assign the correct attribute.

Change-Id: Idfe001229656cd505e8b88b72315706da03d5120
Reviewed-on: https://gerrit.stanford.edu/652
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Use a different layout for Perl function comments

The template suggested by Perl Best Practices is both large and
kind of cluttered.  Use something that's closer to free-form text
but that breaks out the parameters separately.

Change-Id: I1367f4a4367ca8b912c5454c2d1e4273fad8f86c
Reviewed-on: https://gerrit.stanford.edu/651
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add POD syntax and spelling checks for the main tree

Now that we have more POD documentation in the main tree outside
of the Perl directory, add POD syntax and spelling checks for it
as well.

Change-Id: I02088a7a7ff12ab5a016af6f8d8c69c6ce8522a9
Reviewed-on: https://gerrit.stanford.edu/650
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add t/strict.t to the Perl module manifest

Change-Id: I64be196b2248eb2770ac0488cede72b6049d813a
Reviewed-on: https://gerrit.stanford.edu/649
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Clean up Perl pod.t and pod-spelling.t tests

Improve comments and coding style for the POD and POD spelling
tests intended to be embedded in a Perl distribution.

Change-Id: Ibb684d86a9fedb96997d2ff92474d4b19e25eaea
Reviewed-on: https://gerrit.stanford.edu/648
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fix several WebLogin syntax errors

The most recent set of changes to WebLogin introduced several
syntax errors and coding problems.  Clean those up.  (I should
have run the test suite like I claimed to have done.)

Change-Id: I29b38fc5a5f65ba23233f8bfe9561f8b6b38fd9f
Reviewed-on: https://gerrit.stanford.edu/647
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Use Pod::Spelling for the POD spelling tests

Stop rolling our own small version of the Test::Spelling module.

Change-Id: I61b68bc532a4b2b559ea73e749117e7a3596aa72
Reviewed-on: https://gerrit.stanford.edu/646
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Use local to localize KRB5CCNAME change in WebLogin

When doing the query for password expiration times, we need to
temporarily change the value of KRB5CCNAME.  Do this with local
so that we don't have to remember the other value and restore it.

Change-Id: I88040f18a0d6253a66216894d22807c1bd33584f
Reviewed-on: https://gerrit.stanford.edu/645
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Suppress a WebLogin Perl warning if pwexpire fails

If the remctl call requesting password expiration information
fails, don't attempt to chomp the result.  Suppresses a (harmless)
Perl warning.

Change-Id: Ie81b0733c3a66dfe3e3dc39f2d974b11663cc47c
Reviewed-on: https://gerrit.stanford.edu/644
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove erroneous statement about realm canonicalization

The realms listed in mod_webkdc directives should just be normal
realm names.  They don't have to be escaped; mod_webkdc no longer
compares escaped forms.

Change-Id: Ic5e822dc98f4e1275b89d3cb860dfc676709328b
Reviewed-on: https://gerrit.stanford.edu/643
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Resynchronize TODO against JIRA and completed work

Change-Id: I719b05c3c1052ee54f3294472036462e5ed05611
Reviewed-on: https://gerrit.stanford.edu/642
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add new WebLogin error template parameters for new errors

Move the error message for replayed authentications and accounts
locked out due to too many failed login attempts into the error
template and out of the WebLogin Perl module.  This will make
site-specific content and localization easier to do.

Change-Id: I1ee90c012903aa1df3bb10c37bd4f03b502a56b0
Reviewed-on: https://gerrit.stanford.edu/641
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>